i have a pcap and filter it to a TCP stream index and source ip. i want to build a file from the packets (reconstruct) streamed data. is there away to do this with Wireshark? or do i need to create my own method for this? asked 19 Mar '12, 15:38  auldh |
One Answer:
That depends on what you're trying to do. If you want all the data from one or both sides of a TCP connection, try using Analyze->Follow TCP Stream and saving from that. If you want an object transferred with, for example, HTTP or the SMB file access protocol, try File->Export->Objects->{HTTP,SMB} (it will offer a list of objects in the capture and let you save one or all of them). If neither of those are what you want, you might want to look at tcpflow. answered 19 Mar '12, 17:30  Guy Harris ♦♦ |
thank you i will do. i only want onside of the stream the receiving side.
the protocol is TCP. i want to extract the TCP segment data of the specified bytes on the receive side/source.
i want to reconstruct that it is not a VOIP so i can't use the telephony feature.
Then it sounds as if you want the first of my suggestins - Analyze->Follow TCP Stream, which, as I remember, will let you save only one side of the conversation if you want that.